CVE-2026-98335 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: abort chanswitch when leaving a mesh
The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]
__ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]
ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438
Abort the channel switch properly.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel's mac80211 subsystem represents a critical use-after-free condition triggered during wireless mesh network operations, specifically when an interface leaves a mesh group while a Channel Switch Announcement is active. This flaw stems from improper lifecycle management of channel context resources within the ieee80211_stop_mesh function. When a device initiates the process to leave a mesh network, the kernel releases the associated channel context structures to free up memory and reset state for potential future use. However, if a Channel Switch Announcement was previously initiated but not yet completed or aborted, residual work items remain scheduled in the system's deferred execution queue. These pending tasks retain references to the now-freed channel context objects.
The technical root cause lies in the failure of ieee80211_stop_mesh to explicitly abort ongoing channel switch operations before releasing resources. Consequently, when the kernel attempts to finalize the CSA through ieee80211_csa_finalize and subsequent beacon rebuilding routines such as ieee80211_mesh_build_beacon, it dereferences pointers that no longer point to valid memory regions. The crash manifests as a general protection fault with KASAN detecting a null pointer dereference or access to non-canonical addresses, specifically within the ieee80211_put_srates_elem function which attempts to process rate elements from corrupted data structures. This sequence of events demonstrates a classic race condition between resource deallocation and asynchronous task execution, where the timing window allows the deferred CSA finalization work to execute after its underlying data has been invalidated by mesh teardown procedures.
From an operational impact perspective, this vulnerability leads directly to kernel panics or system crashes on affected systems operating as wireless mesh nodes. For network administrators relying on stable IEEE 802.11s mesh deployments for critical infrastructure connectivity, such instability can result in significant service interruptions and potential denial of service conditions without requiring external exploitation. The crash occurs during normal administrative actions like disconnecting from a mesh or reconfiguring interface roles, meaning it is triggered by legitimate system usage rather than malicious packet injection alone, although an attacker could potentially accelerate the timing to increase exploitability probability.
This flaw aligns with CWE-416, Use After Free, as the code accesses memory after it has been freed due to incorrect ordering of cleanup operations. In terms of attack vector classification under MITRE ATT&CK, this relates to Tactic TA0005 Defense Evasion or potentially TA0003 Persistence if exploited in conjunction with other vulnerabilities, but primarily represents a reliability issue classified under system resource management failures rather than direct remote code execution vectors unless combined with further exploitation techniques. The vulnerability highlights the complexity of managing asynchronous kernel workqueues and their interaction with hardware-specific driver states in high-performance networking stacks.
Mitigation strategies involve applying the upstream Linux kernel patch that modifies ieee80211_stop_mesh to explicitly call abort mechanisms for any pending channel switch operations before releasing channel contexts. System administrators should ensure their kernels are updated to versions containing this fix, particularly those running mesh-enabled interfaces or participating in wireless ad-hoc networks. For environments where immediate patching is not feasible, disabling automatic CSA features on mesh nodes and avoiding dynamic role changes during active network sessions can reduce the likelihood of triggering the condition until a permanent software update is deployed. Regular auditing of kernel logs for general protection faults related to mac80211 components serves as an effective monitoring practice to detect potential exploitation attempts or instability events early in their lifecycle.